Hello istio

Hello ISTIO!
Service Mesh and Microservices
Jooho Lee

Who am I?
Jooho Lee
Senior Technical Account Manager in Toronto Red Hat
OpenShift User Group Administrator in Facebook
Ansible User Group Administrator in Facebook

Routing & Load Balancing
Service Discovery
Failures, Timeouts and Retries
Monitoring, Metrics and Tracing
Logging
Back Pressure and Shadowing
A/B Testing
Rate Limiting
Authentication and Authorization
Security
Access Control
Circuit Breaking
Feature Lists

Netflix OSS
● A set of frameworks to solve microservice problems at scale
○ Hystrix, Zuul, Eureka, Zipkin, Ribbon, Atlas
● Only Java support
➔ Different frameworks for different languages
◆ Spring, Node, Go?
➔ Inconsistent
➔ Built right into the apps
For Polyglot Programming?

Hello ISTIO!
https://istio.io

Main Components
● Envoy
○ Deployed as a sidecar to intercept all inbound and outbound traffic, Istio uses the many
features of Envoy Proxy in a transparent, agnostic way
● Mixer
○ Mixer acts on request attributes from each envoy. This allows for advanced access control,
usage and telemetry
● Pilot
○ Pilot abstracts and controls. Using your defined rules around traffic management, routing
and resiliency, it converts and sends the config to the Envoy proxies
● Citadel
○ Key and cert management for secure service to service and end user authentication.

Control Plane -ISTIO-SYSTEM
Egress Gateway Ingress Gateway
Sidecar-Injector Statsd-Prom-BridgeCleanup-Secrets
CitadelGalleyPilot Policy Telemetry
Mixer
Grafana
Grafana-post
TracingPrometheus Service Graph

Flow
Egress GatewayIngress Gateway
CitadelGalleyPilot Policy Telemetry
Mixer Control Plane
RouterClient
Envoy Envoy
Chat Client Chat Server
CDN

….
kind: Deployment
….
template:
metadata:
annotations:
sidecar.istio.io/inject: "true"
labels:
…..
Auto Inject is available

The I to O of ISTIO
Show me some cool things!
● Install ISTIO!!
● Demo 1 - Base Deployment (Get Ready)
● Demo 2 - Smart Canaries - Routing Based on Headers
● Demo 3 - Smart Canaries - Egress Traffic
● Demo 4 - Smart Canaries - Canary Deployment
● Demo 5 - Service Resiliency - Load Balancing
● Demo 6 - Service Resiliency - Pod Ejection
● Demo 7 - Service Resiliency - Timeout
● Demo 8 - Chaos Testing - Retry + Fault Inject
● Demo 9 - Service Resiliency - Circuit Breaker
● Demo 10 - Monitoring - Tracing, Metrics

Demo 1 - Base Deployment
API-Server (Auth)
Server
Client(ETC)
Client(Android)
Client(Apple)
Redis
CDN
Please Connect
⇒chat-client.apps.toronto.openshiftworkshop.com

Next
● Allow Egress(CDN) from chat server
API-Server (Auth)
Server
Client(ETC)
Client(Android)
Client(Apple)
Check
● Refresh page
○ Check the log on top left
● Go to chat room
○ Refresh page
■ Messages gone
Redis
CDN
Demo 2 - Smart Canaries, Routing on Headers
chat-client.apps.toronto.openshiftworkshop.com

Next
- Deploy V2 Chat Server
API-Server (Auth)
Server
Client(ETC)
Client(Android)
Client(Apple)
Check
● Refresh page
○ Red Hat Logo is shown
Redis
CDN
Demo 3 - Smart Canaries, Egress Traffic

Check
● Login → Chat Room
○ Check Server Version
○ 90/10 Distribution
○ All messages remained
API-Server (Auth)
Server (v2)
Client(ETC)
Client(Android)
Client(Apple)
Server (v1)
Redis
Next
● Rollback virtual service of chat-server
to initial state
● Scale Out Server v2 to 3
● Load Balancing
Demo 4 - Smart Canaries, Canary Deployment

Check
● ¼ users -> v1(25%)
● ¾ users ->v2 (75%)
● Add Destination Rule (LB: RANDOM)
○ Randomly pick v1 and v2
API-Server (Auth)
Server (v2)
Client(ETC)
Client(Android)
Client(Apple)
Server (v1)
Redis
Next
● Scale Down Server v2 to 1
● Scale Out API-Server to 2
● Occur 503 on one of API Server
Server (v2)
Server (v2)
Demo 5 - Service Resiliency & Load Balancing

Check
● POD Ejection
○ The problematic pod will be
ejected from service
Server (v2)Client(ETC)
Client(Android)
Client(Apple)
Server (v1)
Redis
Next
● Long Tasks(5sec)
● Set 1s timeout from chat server to auth
API-Server (Auth) API-Server (Auth)503
Demo 6 - Service Resiliency, Pod Ejection

Check
● Response time has to be
under 1 secs
Server (v2)
Client(ETC)
Client(Android)
Client(Apple)
Server (v1)
Redis
Next
● Scale Down API Server to 1
● Give fault inject (Server → Auth)
● Set retry policy (Server → Auth)
API-Server (Auth) API-Server (Auth)
Timeout
Long Task
Demo 7 - Service Resiliency, Timeouts

Check
● No 503 errors
Server (v2)
Client(ETC)
Client(Android)
Client(Apple)
Server (v1)
Redis
Next
● Give fault inject (Server → Auth)
● Set retry policy (Server → Auth)
API-Server (Auth)
503 Fault InjectionRetry
Demo 8 - Chaos Testing, Retry, Fault Injection

Check
● 503 errors if there are many
requests by circuit breaker
Server (v2)Client(ETC)
Client(Android)
Client(Apple)
Server (v1)
Redis
Next
● Metrics
● Tracing
API-Server (Auth)
503
Demo 9 - Service Resiliency, Circuit Breaker

Demo 10 - Monitoring and Tracing
http://prometheus-istio-system.apps.toronto.openshiftworkshop.com

Demo 10 - Monitoring and Metrics
http://grafana-istio-system.apps.toronto.openshiftworkshop.com

Demo:
● https://github.com/Jooho/jhouse_openshift/demos/Hello_ISTIO
Training:
● https://learn.openshift.com/servicemesh
Sample Applications
● https://istio.io/docs/examples/bookinfo/
● https://github.com/redhat-developer-demos
References

Hello istio

More Related Content

What's hot (20)

Similar to Hello istio (20)

More from Jooho Lee (7)

Recently uploaded (20)

Hello istio